SY0-701 Security Architecture Practice Question
An operations team manages Linux servers over SSH. The security team wants to stop direct management access from employee laptops, reduce lateral movement if one admin endpoint is compromised, and keep a log of every administrative session. Which two design choices best fit? Select two.
⚠ Common exam trap
Watch out — candidates often think MFA alone (Option B) is sufficient to secure direct access, but the question specifically requires reducing lateral movement and logging sessions, which only a bastion host with restricted access (Option A and C) can fully achieve.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Require administrators to connect to a bastion host or jump server before reaching the Linux servers.
A bastion host (jump server) acts as a single, hardened entry point that administrators must connect to before reaching internal Linux servers. This eliminates direct SSH access from employee laptops, reducing the attack surface and preventing lateral movement if an admin endpoint is compromised. The bastion host can also enforce centralized logging of all administrative sessions, meeting the security team's requirement for session recording.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Require administrators to connect to a bastion host or jump server before reaching the Linux servers.
Why this is correct
A bastion host is a hardened choke point for privileged access, so all administrative sessions can be concentrated, filtered, and monitored. It prevents direct SSH exposure from general user systems and gives the security team a single place to enforce logging and session control. This is a common hardened management-path pattern.
- ✗
Let all corporate laptops connect directly to SSH on the servers if MFA is enabled.
Why it's wrong here
Enabling MFA on direct SSH connections does not prevent lateral movement if an admin laptop is compromised, because an attacker with access to an authenticated session can still pivot to other servers without re-authenticating. This design also fails to log every administrative session centrally, as SSH logs remain on individual servers rather than being captured in a session recorder or jump host. It is tempting because MFA is a strong authentication control that reduces credential theft risk, and in a scenario where only authentication security matters—without requirements for session logging or lateral movement containment—it would be a valid choice.
- ✓
Restrict management interfaces so only the bastion host can reach them and log each session.
Why this is correct
Limiting server management interfaces to the bastion host creates a strong network boundary and prevents administrators from bypassing the controlled access path. Session logging provides traceability and supports investigations and accountability. This complements the bastion by ensuring the network architecture enforces the same control model.
- ✗
Expose SSH to the internet because key-based authentication is already strong.
Why it's wrong here
Publicly exposing SSH is unnecessary and increases brute-force, scanning, and exploitation risk. Key-based authentication helps, but it does not justify direct internet access to management services. The requirement is to remove direct access from employee laptops, not extend management services to untrusted networks.
- ✗
Use split tunneling for admin traffic so management packets can bypass the VPN.
Why it's wrong here
Split tunneling is generally used to route some traffic outside the secure tunnel, which is the opposite of what this scenario needs. Management traffic should be tightly controlled and inspected, not routed around security controls. Bypassing the VPN would weaken the protected management path.
Go deeper
Related to this question
Learn chapter
Cloud Security Fundamentals
Key term
Attack surface
The attack surface is the total sum of all points in a system, network, or application where an unauthorized user can try to enter or extract data.
Key term
Lateral movement
Lateral movement is the technique attackers use to move through a network from one compromised system to another, seeking sensitive data or higher privileges.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.